---
title: Mercado Bitcoin, Brazil's largest crypto exchange, suspends deposits and withdrawals after an overnight security incident; Hypernative estimates more than $40M moved, Tether freezes 4.5M USDT | ctxsec
url: https://ctxsec.com/items/mercado-bitcoin-security-incident-withdrawals-suspended-nov-2
description: "Mercado Bitcoin said on Nov 2 that it identified and contained a security incident in one of its systems overnight, that clients lost nothing and no data leaked, and that deposits and withdrawals are suspended while it traces the assets with authorities. It later published the attacker's destination addresses on EVM chains, Bitcoin, Solana, Stellar and Tron. Hypernative estimates more than $40 million moved in plain transfers across at least 10 chains, and Tether CEO Paolo Ardoino says over 4.5 million USDT tied to the incident is frozen. How the attacker got signing access is not known."
status: "official (Mercado Bitcoin statements on X, Nov 2; Tether CEO on the freeze); the ~$40M figure is Hypernative's estimate, not confirmed by the exchange"
published: 2026-11-02
---

> Mercado Bitcoin said on Nov 2 that it identified and contained a security incident in one of its systems overnight, that clients lost nothing and no data leaked, and that deposits and withdrawals are suspended while it traces the assets with authorities. It later published the attacker's destination addresses on EVM chains, Bitcoin, Solana, Stellar and Tron. Hypernative estimates more than $40 million moved in plain transfers across at least 10 chains, and Tether CEO Paolo Ardoino says over 4.5 million USDT tied to the incident is frozen. How the attacker got signing access is not known.

[← Cybersecurity News](/news) · [markdown](/items/mercado-bitcoin-security-incident-withdrawals-suspended-nov-2.md)

official (Mercado Bitcoin statements on X, Nov 2; Tether CEO on the freeze); the ~$40M figure is Hypernative's estimate, not confirmed by the exchange

2026-11-02

### Mercado Bitcoin, Brazil's largest crypto exchange, suspends deposits and withdrawals after an overnight security incident; Hypernative estimates more than $40M moved, Tether freezes 4.5M USDT

- **Official statement (12:56 UTC, Nov 2):** Mercado Bitcoin says it "identified and quickly contained" a security incident in one of its systems overnight, with no losses to customers and no data leak. Deposits and withdrawals are suspended as a precaution while teams investigate, trace the assets and coordinate with authorities. It has not given a loss figure.
- **Update (14:24 UTC):** the exchange published destination addresses tied to the incident for tracking: EVM `0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478`, BTC `19qGpsHvzh1t6pVi526XNNkh6hW6prDZp`, SOL `3YX6WHncP1Ra4AotE9YLawFt4nPmxyux288FWXkEW97J`, Tron `TEX3HuDRHRa3tnYpy96M4UfSx62VhDyA5L`, plus a Stellar address.
- **On-chain check:** the BTC address has received 106.07 BTC in 7 transactions and had spent none when this item was written (Blockstream explorer).
- **Third-party estimate (not confirmed by the exchange):** Hypernative, as reported by Unchained, says the outflows were plain transfers rather than a smart-contract exploit, that most funds moved between 06:19 and 06:53 UTC with Bitcoin deposit-address sweeps starting at 02:15 UTC, and that the attacker holds about 2,852 ETH, 106 BTC, 10,700 SOL and 6.7M XLM plus 200+ other tokens, more than $40 million in total.
- **Freeze:** Tether CEO Paolo Ardoino says Tether froze more than 4.5 million USDT related to the incident.

**Not known:** how signing access was obtained, and whether this is linked to any other recent exchange theft; neither the exchange nor Hypernative has tied it to the Oct 29 Binance theft. **For other custodians:** plain transfers from hot and deposit wallets point to key or signing-service compromise rather than a contract bug, so alert on deposit-address sweeps to new destinations outside normal consolidation windows and cap automated signing per time window.

Sources: [Mercado Bitcoin on X: official statement (Nov 2, in Portuguese)](https://x.com/MercadoBitcoin/status/2117239507263132056) · [Mercado Bitcoin on X: destination addresses (Nov 2, in Portuguese)](https://x.com/MercadoBitcoin/status/2117261565200146525) · [Paolo Ardoino (Tether CEO) on X: 4.5M USDT frozen (Nov 2)](https://x.com/paoloardoino/status/2117272224814219720) · [Unchained: Mercado Bitcoin halts withdrawals as Hypernative flags $40M drain (Nov 2)](https://unchainedcrypto.com/mercado-bitcoin-halts-withdrawals-over-security-incident-as-hypernative-flags-40-million-drain/) · [Blockstream explorer: BTC destination address](https://blockstream.info/address/19qGpsHvzh1t6pVi526XNNkh6hW6prDZp)